@camstack/addon-post-analysis 1.2.151 → 1.2.152

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -13536,6 +13536,133 @@ var embeddingEncoderCapability = {
13536
13536
  }
13537
13537
  };
13538
13538
  /**
13539
+ * `failure-contribution` — the capability an addon reports its OWN losses
13540
+ * through, per camera, with the denominator attached. It stores nothing.
13541
+ *
13542
+ * ## The twin of `load-contribution`, and why it is a twin and not a field
13543
+ *
13544
+ * `load-contribution` answers *what did this camera COST*. This answers *what
13545
+ * did this camera LOSE*. The reporting discipline is identical and deliberately
13546
+ * copied: the contributor reports what it already knows, hub-main adds only
13547
+ * `addonId`, nothing needs global knowledge, and there is no central list for
13548
+ * somebody to forget to edit.
13549
+ *
13550
+ * They are not merged, because their invariants are opposites:
13551
+ *
13552
+ * - a `load-contribution` measurement is **absent, never zero** — a zero would
13553
+ * claim a camera cost nothing, which is a measurement nobody made;
13554
+ * - a `failure-contribution` zero is the **most valuable value on the
13555
+ * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
13556
+ * and it is exactly what an absent entry cannot say.
13557
+ *
13558
+ * Putting a loss counter on a cost entry would also break the reconciliation
13559
+ * that gives `load-contribution` its point: contributions are subtracted from
13560
+ * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
13561
+ * has no process.
13562
+ *
13563
+ * ## Why not a log line, since the counters already exist
13564
+ *
13565
+ * Several of these paths already counted themselves — `CaptureScheduler`'s
13566
+ * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
13567
+ * ends in a log line, and a log line is the thing the operator asked to stop
13568
+ * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
13569
+ * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
13570
+ * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
13571
+ * media blackout were both diagnosed. The counters stay; this is where they can
13572
+ * be READ.
13573
+ *
13574
+ * ## The rate is served with its denominator or not at all
13575
+ *
13576
+ * Every entry carries `attempts` and `succeeded`. A miss count alone is
13577
+ * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
13578
+ * than yesterday" and was **flat across twelve hours** once divided by the
13579
+ * successes on the same path. A surface that publishes only the numerator
13580
+ * reproduces that mistake on every read.
13581
+ *
13582
+ * ## Shape
13583
+ *
13584
+ * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
13585
+ * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
13586
+ * generated hooks, while `addons.listCapabilityProviders` still enumerates it
13587
+ * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
13588
+ * a forked runner's entries reach hub-main over transport that already exists.
13589
+ * No new UDS message, no second registry (D3). The operator reads the assembled
13590
+ * result through `system.getFailureContributions`.
13591
+ */
13592
+ var FailureReasonCountSchema = object({
13593
+ /**
13594
+ * Why the attempt did not land, in the contributor's own vocabulary —
13595
+ * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
13596
+ * strings that already appear in this repo's logs and, where one exists, the
13597
+ * same string the per-track `previewMissReason` records (D276): a second
13598
+ * vocabulary for the same loss would make the row and the counter
13599
+ * un-joinable.
13600
+ */
13601
+ reason: string(),
13602
+ count: number().int().nonnegative()
13603
+ });
13604
+ var FailureContributionSchema = object({
13605
+ /**
13606
+ * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
13607
+ * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
13608
+ * `unit` free: the families are owned by different addons and a shared enum
13609
+ * is a central list that rots invisibly.
13610
+ */
13611
+ family: string(),
13612
+ /**
13613
+ * The NUMERIC device id — the same value every log line carries as
13614
+ * `tags.deviceId`. Never nullable and never absent: a contributor that
13615
+ * cannot name the camera must not emit the entry, because a fleet total
13616
+ * cannot answer the only question anybody asks of this surface.
13617
+ */
13618
+ deviceId: number().int().positive(),
13619
+ /**
13620
+ * A second dimension inside the family: the model / step id for an inference
13621
+ * timeout, so "which camera AND which model" is one read. Absent when the
13622
+ * family has a single variant.
13623
+ */
13624
+ variant: string().optional(),
13625
+ /**
13626
+ * Epoch ms this counter started — the INCARNATION MARKER. A consumer
13627
+ * differencing two reads must drop the interval when it changes, because the
13628
+ * counter restarted from zero in a respawned runner. Same discipline as
13629
+ * `LoadContribution.startedAtMs`.
13630
+ */
13631
+ sinceMs: number(),
13632
+ /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
13633
+ atMs: number(),
13634
+ /**
13635
+ * THE DENOMINATOR — every attempt on this path for this camera in the
13636
+ * window. A failure count published without it is the mistake this schema
13637
+ * exists to make impossible.
13638
+ */
13639
+ attempts: number().int().nonnegative(),
13640
+ /** Attempts that landed. `attempts - succeeded` is the loss. */
13641
+ succeeded: number().int().nonnegative(),
13642
+ /** The loss, partitioned. Sums to `attempts - succeeded`. */
13643
+ reasons: array(FailureReasonCountSchema).readonly()
13644
+ });
13645
+ var failureContributionCapability = {
13646
+ name: "failure-contribution",
13647
+ scope: "system",
13648
+ mode: "collection",
13649
+ internal: true,
13650
+ methods: {
13651
+ /**
13652
+ * This addon's per-camera failure counters, read live from bounded in-RAM
13653
+ * state it already keeps. Inert: no persistence, no sampling, no timer.
13654
+ *
13655
+ * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
13656
+ * consumer that wants a rate differences two reads. A draining read would
13657
+ * make two operators with the page open each destroy half of the other's
13658
+ * numbers, and `load-contribution` already settled the same question the
13659
+ * same way for `cpuSeconds`.
13660
+ */
13661
+ list: method(_void(), array(FailureContributionSchema).readonly()) },
13662
+ /** In-process only — enumerated through `addons.listCapabilityProviders`. */
13663
+ mount: { kind: "skip" }
13664
+ };
13665
+ /**
13539
13666
  * filesystem-browse — per-node capability for browsing the node's local
13540
13667
  * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
13541
13668
  * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -14057,6 +14184,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
14057
14184
  kind: "mutation",
14058
14185
  auth: "admin"
14059
14186
  });
14187
+ var LoadContributionSchema = object({
14188
+ role: _enum([
14189
+ "decode",
14190
+ "transcode",
14191
+ "recording",
14192
+ "streaming",
14193
+ "detection"
14194
+ ]),
14195
+ /**
14196
+ * The NUMERIC device id — the same value every log line carries as
14197
+ * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14198
+ * camera (a shared pool), NOT that the contributor forgot to look it up: a
14199
+ * contributor that cannot name its camera must not emit the entry at all,
14200
+ * because an unnamed per-camera entry is indistinguishable from a shared one
14201
+ * and would quietly turn one camera's cost into everybody's.
14202
+ */
14203
+ deviceId: number().int().positive().nullable(),
14204
+ attribution: _enum([
14205
+ "measured",
14206
+ "accounted",
14207
+ "unattributable"
14208
+ ]),
14209
+ /**
14210
+ * What ONE entry is, in the contributor's own words — `615/high`,
14211
+ * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14212
+ * family and inventing a common one would lose the only information that
14213
+ * makes two entries for the same camera distinguishable.
14214
+ */
14215
+ unit: string(),
14216
+ /**
14217
+ * The OS process this cost lives in, when there is one. Present so a
14218
+ * consumer can (a) tell two generations of the same unit apart across a
14219
+ * restart, and (b) subtract claimed processes from the node's process
14220
+ * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14221
+ * process of its own.
14222
+ */
14223
+ pid: number().int().positive().optional(),
14224
+ /**
14225
+ * When this generation started. The pid's incarnation marker: a consumer
14226
+ * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14227
+ * window when this changes, because the counter restarted from zero in a new
14228
+ * process.
14229
+ */
14230
+ startedAtMs: number().optional(),
14231
+ /**
14232
+ * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14233
+ * system, read from the child's own `/proc/<pid>/stat` at the moment the
14234
+ * contribution is asked for.
14235
+ *
14236
+ * Cumulative and not a rate on purpose: a rate needs a window, a window
14237
+ * needs a sampler, and a new per-node sampler is the defect half of
14238
+ * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14239
+ * by whoever already keeps a history; a rate cannot be un-averaged.
14240
+ *
14241
+ * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14242
+ * an entry with no process.
14243
+ */
14244
+ cpuSeconds: number().optional(),
14245
+ /** Resident bytes of this unit's process, same source and same rules. */
14246
+ rssBytes: number().optional()
14247
+ });
14248
+ method(_void(), array(LoadContributionSchema).readonly());
14060
14249
  /**
14061
14250
  * `log-channels` — the capability an addon DECLARES its diagnostic channels
14062
14251
  * through. It stores nothing.
@@ -14133,195 +14322,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
14133
14322
  tags: record(string(), string()).optional()
14134
14323
  }), array(LogEntrySchema).readonly());
14135
14324
  /**
14136
- * `failure-contribution` — the capability an addon reports its OWN losses
14137
- * through, per camera, with the denominator attached. It stores nothing.
14138
- *
14139
- * ## The twin of `load-contribution`, and why it is a twin and not a field
14140
- *
14141
- * `load-contribution` answers *what did this camera COST*. This answers *what
14142
- * did this camera LOSE*. The reporting discipline is identical and deliberately
14143
- * copied: the contributor reports what it already knows, hub-main adds only
14144
- * `addonId`, nothing needs global knowledge, and there is no central list for
14145
- * somebody to forget to edit.
14146
- *
14147
- * They are not merged, because their invariants are opposites:
14148
- *
14149
- * - a `load-contribution` measurement is **absent, never zero** — a zero would
14150
- * claim a camera cost nothing, which is a measurement nobody made;
14151
- * - a `failure-contribution` zero is the **most valuable value on the
14152
- * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
14153
- * and it is exactly what an absent entry cannot say.
14154
- *
14155
- * Putting a loss counter on a cost entry would also break the reconciliation
14156
- * that gives `load-contribution` its point: contributions are subtracted from
14157
- * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
14158
- * has no process.
14159
- *
14160
- * ## Why not a log line, since the counters already exist
14161
- *
14162
- * Several of these paths already counted themselves — `CaptureScheduler`'s
14163
- * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
14164
- * ends in a log line, and a log line is the thing the operator asked to stop
14165
- * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
14166
- * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
14167
- * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
14168
- * media blackout were both diagnosed. The counters stay; this is where they can
14169
- * be READ.
14170
- *
14171
- * ## The rate is served with its denominator or not at all
14172
- *
14173
- * Every entry carries `attempts` and `succeeded`. A miss count alone is
14174
- * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
14175
- * than yesterday" and was **flat across twelve hours** once divided by the
14176
- * successes on the same path. A surface that publishes only the numerator
14177
- * reproduces that mistake on every read.
14178
- *
14179
- * ## Shape
14180
- *
14181
- * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
14182
- * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
14183
- * generated hooks, while `addons.listCapabilityProviders` still enumerates it
14184
- * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
14185
- * a forked runner's entries reach hub-main over transport that already exists.
14186
- * No new UDS message, no second registry (D3). The operator reads the assembled
14187
- * result through `system.getFailureContributions`.
14188
- */
14189
- var FailureReasonCountSchema = object({
14190
- /**
14191
- * Why the attempt did not land, in the contributor's own vocabulary —
14192
- * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
14193
- * strings that already appear in this repo's logs and, where one exists, the
14194
- * same string the per-track `previewMissReason` records (D276): a second
14195
- * vocabulary for the same loss would make the row and the counter
14196
- * un-joinable.
14197
- */
14198
- reason: string(),
14199
- count: number().int().nonnegative()
14200
- });
14201
- var FailureContributionSchema = object({
14202
- /**
14203
- * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
14204
- * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
14205
- * `unit` free: the families are owned by different addons and a shared enum
14206
- * is a central list that rots invisibly.
14207
- */
14208
- family: string(),
14209
- /**
14210
- * The NUMERIC device id — the same value every log line carries as
14211
- * `tags.deviceId`. Never nullable and never absent: a contributor that
14212
- * cannot name the camera must not emit the entry, because a fleet total
14213
- * cannot answer the only question anybody asks of this surface.
14214
- */
14215
- deviceId: number().int().positive(),
14216
- /**
14217
- * A second dimension inside the family: the model / step id for an inference
14218
- * timeout, so "which camera AND which model" is one read. Absent when the
14219
- * family has a single variant.
14220
- */
14221
- variant: string().optional(),
14222
- /**
14223
- * Epoch ms this counter started — the INCARNATION MARKER. A consumer
14224
- * differencing two reads must drop the interval when it changes, because the
14225
- * counter restarted from zero in a respawned runner. Same discipline as
14226
- * `LoadContribution.startedAtMs`.
14227
- */
14228
- sinceMs: number(),
14229
- /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
14230
- atMs: number(),
14231
- /**
14232
- * THE DENOMINATOR — every attempt on this path for this camera in the
14233
- * window. A failure count published without it is the mistake this schema
14234
- * exists to make impossible.
14235
- */
14236
- attempts: number().int().nonnegative(),
14237
- /** Attempts that landed. `attempts - succeeded` is the loss. */
14238
- succeeded: number().int().nonnegative(),
14239
- /** The loss, partitioned. Sums to `attempts - succeeded`. */
14240
- reasons: array(FailureReasonCountSchema).readonly()
14241
- });
14242
- var failureContributionCapability = {
14243
- name: "failure-contribution",
14244
- scope: "system",
14245
- mode: "collection",
14246
- internal: true,
14247
- methods: {
14248
- /**
14249
- * This addon's per-camera failure counters, read live from bounded in-RAM
14250
- * state it already keeps. Inert: no persistence, no sampling, no timer.
14251
- *
14252
- * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
14253
- * consumer that wants a rate differences two reads. A draining read would
14254
- * make two operators with the page open each destroy half of the other's
14255
- * numbers, and `load-contribution` already settled the same question the
14256
- * same way for `cpuSeconds`.
14257
- */
14258
- list: method(_void(), array(FailureContributionSchema).readonly()) },
14259
- /** In-process only — enumerated through `addons.listCapabilityProviders`. */
14260
- mount: { kind: "skip" }
14261
- };
14262
- var LoadContributionSchema = object({
14263
- role: _enum([
14264
- "decode",
14265
- "transcode",
14266
- "recording",
14267
- "streaming",
14268
- "detection"
14269
- ]),
14270
- /**
14271
- * The NUMERIC device id — the same value every log line carries as
14272
- * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14273
- * camera (a shared pool), NOT that the contributor forgot to look it up: a
14274
- * contributor that cannot name its camera must not emit the entry at all,
14275
- * because an unnamed per-camera entry is indistinguishable from a shared one
14276
- * and would quietly turn one camera's cost into everybody's.
14277
- */
14278
- deviceId: number().int().positive().nullable(),
14279
- attribution: _enum([
14280
- "measured",
14281
- "accounted",
14282
- "unattributable"
14283
- ]),
14284
- /**
14285
- * What ONE entry is, in the contributor's own words — `615/high`,
14286
- * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14287
- * family and inventing a common one would lose the only information that
14288
- * makes two entries for the same camera distinguishable.
14289
- */
14290
- unit: string(),
14291
- /**
14292
- * The OS process this cost lives in, when there is one. Present so a
14293
- * consumer can (a) tell two generations of the same unit apart across a
14294
- * restart, and (b) subtract claimed processes from the node's process
14295
- * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14296
- * process of its own.
14297
- */
14298
- pid: number().int().positive().optional(),
14299
- /**
14300
- * When this generation started. The pid's incarnation marker: a consumer
14301
- * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14302
- * window when this changes, because the counter restarted from zero in a new
14303
- * process.
14304
- */
14305
- startedAtMs: number().optional(),
14306
- /**
14307
- * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14308
- * system, read from the child's own `/proc/<pid>/stat` at the moment the
14309
- * contribution is asked for.
14310
- *
14311
- * Cumulative and not a rate on purpose: a rate needs a window, a window
14312
- * needs a sampler, and a new per-node sampler is the defect half of
14313
- * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14314
- * by whoever already keeps a history; a rate cannot be un-averaged.
14315
- *
14316
- * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14317
- * an entry with no process.
14318
- */
14319
- cpuSeconds: number().optional(),
14320
- /** Resident bytes of this unit's process, same source and same rules. */
14321
- rssBytes: number().optional()
14322
- });
14323
- method(_void(), array(LoadContributionSchema).readonly());
14324
- /**
14325
14325
  * `login-method` — collection cap through which auth addons contribute
14326
14326
  * their pre-auth login surfaces to the login page. This is the SINGLE,
14327
14327
  * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -19687,12 +19687,53 @@ var MediaFileKindEnum = _enum([
19687
19687
  "keyFrameSmall",
19688
19688
  "thumbnailSmall"
19689
19689
  ]);
19690
+ /**
19691
+ * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
19692
+ * ARE — never the bytes themselves.
19693
+ *
19694
+ * ## Why `url` and not `base64`
19695
+ *
19696
+ * Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
19697
+ * with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
19698
+ * was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
19699
+ * wire. Forty events is ~144 MB. Every byte of it was read off disk,
19700
+ * base64-encoded, held whole in a unary tRPC envelope, and materialised in
19701
+ * hub-main's heap on the way past — for an `<img>` that would have cached it.
19702
+ *
19703
+ * `url` points at the `event-media` data plane
19704
+ * (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
19705
+ * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
19706
+ * render a `?variant=thumb`, and streams. The hub gate in front of it requires
19707
+ * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
19708
+ * no less protected than they were inside a `view`-level cap response — see
19709
+ * `data-plane-access.ts` for the rule and the one gap it does not close
19710
+ * (per-device scoping).
19711
+ *
19712
+ * The URL is built from the row's **stored** key, which is not always its
19713
+ * published `kind`: a track's face/plate crop is stored as `crop` under
19714
+ * `('face'|'plate', '<prefix>-<trackId>')` and published as
19715
+ * `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
19716
+ *
19717
+ * ## `base64` is TRANSITIONAL and is going away
19718
+ *
19719
+ * It is still populated for one reason: the deployed viewer's track-detail
19720
+ * HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
19721
+ * REQUIRES the field), and a row without it parses as a FAILED read — the red
19722
+ * triangle — not as absence. Removing the field before that viewer ships is an
19723
+ * outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
19724
+ * delete this line and the `withBytes` pass-through in
19725
+ * `analytics-query-facade.ts`; nothing else reads it.
19726
+ */
19690
19727
  var MediaFileSchema = object({
19691
19728
  key: string(),
19692
19729
  kind: MediaFileKindEnum,
19693
- base64: string(),
19694
19730
  sizeBytes: number(),
19695
19731
  timestamp: number()
19732
+ }).extend({
19733
+ /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
19734
+ url: string(),
19735
+ /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
19736
+ base64: string()
19696
19737
  });
19697
19738
  /**
19698
19739
  * One media row WITHOUT its bytes.
@@ -19704,7 +19745,9 @@ var MediaFileSchema = object({
19704
19745
  * blocks the whole view.
19705
19746
  *
19706
19747
  * `sizeBytes` is carried because it is what lets a client decide between the
19707
- * stored blob and a `?variant=thumb` rendering without fetching either.
19748
+ * stored blob and a `?variant=thumb` rendering without fetching either, and
19749
+ * `url` because a client that had to build the plane path itself is a second
19750
+ * copy of a route — the embed, the viewer and the admin UI each grew one.
19708
19751
  */
19709
19752
  var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
19710
19753
  /**
@@ -20836,6 +20879,26 @@ var pipelineAnalyticsCapability = {
20836
20879
  deviceId: number()
20837
20880
  }), array(MediaFileInfoSchema).readonly()),
20838
20881
  /**
20882
+ * What media an EVENT has, without any of it — the twin `getEventMedia`
20883
+ * never had.
20884
+ *
20885
+ * `listTrackMedia` above got this treatment because a track's media is
20886
+ * 5-8 MB. An event's is worse per row, not better: an old-style event owns
20887
+ * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
20888
+ * modal — the one surface that legitimately shows the big kinds — unions
20889
+ * both listings to build its filmstrip. It then renders every tile from
20890
+ * the `event-media` plane by key and throws the bytes away. Measured on
20891
+ * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
20892
+ * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
20893
+ *
20894
+ * Same `deviceId` authorization subject as `getEventMedia`, and the same
20895
+ * rows — this is a projection of that method, never a different question.
20896
+ */
20897
+ listEventMedia: method(object({
20898
+ eventId: string(),
20899
+ deviceId: number()
20900
+ }), array(MediaFileInfoSchema).readonly()),
20901
+ /**
20839
20902
  * Search object events by text query using CLIP cosine similarity.
20840
20903
  * Encodes `text` via the `embedding-encoder` cap, queries the
20841
20904
  * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -25899,10 +25962,24 @@ var FaceClusterSchema = object({
25899
25962
  size: number().int(),
25900
25963
  cohesion: number()
25901
25964
  });
25965
+ /**
25966
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
25967
+ * are — never the bytes.
25968
+ *
25969
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
25970
+ * track/event contract) is still populated because a deployed viewer requires
25971
+ * the field to parse a row at all; this method has no such reader. Its ONE
25972
+ * caller is the admin UI's detail modal, which was building
25973
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
25974
+ * dialog already rendering its key FRAME from the `event-media` plane.
25975
+ *
25976
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
25977
+ * media key directly, so this needed no new plane and no new access decision.
25978
+ */
25902
25979
  var MediaFileLiteSchema$1 = object({
25903
25980
  key: string(),
25904
25981
  kind: string(),
25905
- base64: string(),
25982
+ url: string(),
25906
25983
  sizeBytes: number(),
25907
25984
  timestamp: number()
25908
25985
  });
@@ -28950,10 +29027,24 @@ var PlateInfoSchema = object({
28950
29027
  */
28951
29028
  cropUrl: string().optional()
28952
29029
  });
29030
+ /**
29031
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
29032
+ * are — never the bytes.
29033
+ *
29034
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
29035
+ * track/event contract) is still populated because a deployed viewer requires
29036
+ * the field to parse a row at all; this method has no such reader. Its ONE
29037
+ * caller is the admin UI's detail modal, which was building
29038
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
29039
+ * dialog already rendering its key FRAME from the `event-media` plane.
29040
+ *
29041
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
29042
+ * media key directly, so this needed no new plane and no new access decision.
29043
+ */
28953
29044
  var MediaFileLiteSchema = object({
28954
29045
  key: string(),
28955
29046
  kind: string(),
28956
- base64: string(),
29047
+ url: string(),
28957
29048
  sizeBytes: number(),
28958
29049
  timestamp: number()
28959
29050
  });
@@ -37101,6 +37192,12 @@ Object.freeze({
37101
37192
  addonId: null,
37102
37193
  access: "view"
37103
37194
  },
37195
+ "pipelineAnalytics.listEventMedia": {
37196
+ capName: "pipeline-analytics",
37197
+ capScope: "device",
37198
+ addonId: null,
37199
+ access: "view"
37200
+ },
37104
37201
  "pipelineAnalytics.listGroups": {
37105
37202
  capName: "pipeline-analytics",
37106
37203
  capScope: "device",
@@ -40724,6 +40821,11 @@ Object.freeze({
40724
40821
  form: "array",
40725
40822
  optional: false
40726
40823
  }],
40824
+ "pipelineAnalytics.listEventMedia": [{
40825
+ name: "deviceId",
40826
+ form: "single",
40827
+ optional: false
40828
+ }],
40727
40829
  "pipelineAnalytics.listGroups": [{
40728
40830
  name: "deviceIds",
40729
40831
  form: "array",
@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
2
2
  __esModule: { value: true },
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
- const require_dist = require("../dist-DpQno5NK.js");
5
+ const require_dist = require("../dist-Bw6cidiJ.js");
6
6
  let node_fs = require("node:fs");
7
7
  node_fs = require_dist.__toESM(node_fs);
8
8
  let node_path = require("node:path");
@@ -1,4 +1,4 @@
1
- import { At as BaseAddon, F as PoolMemoryWatchdog, St as resolvePoolMemoryPolicy, at as embeddingEncoderCapability, gt as parseProcStatus, ut as hfModelUrl } from "../dist-B5K63Zmt.mjs";
1
+ import { At as BaseAddon, F as PoolMemoryWatchdog, St as resolvePoolMemoryPolicy, at as embeddingEncoderCapability, gt as parseProcStatus, ut as hfModelUrl } from "../dist-DSg_jDMt.mjs";
2
2
  import { createRequire } from "node:module";
3
3
  import * as fs from "node:fs";
4
4
  import * as path$1 from "node:path";
@@ -1,6 +1,6 @@
1
1
  import { a as e, i as t, n, o as r, r as i, t as a } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare__react__loadShare__.js-C0AuF9av.mjs";
2
2
  import { t as o } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-B3Wx5J80.mjs";
3
- import { a as s, i as c, n as l, o as u, r as d, s as f, t as p } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-D8CtX8cU.mjs";
3
+ import { a as s, i as c, n as l, o as u, r as d, s as f, t as p } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-DxVeMmnD.mjs";
4
4
  import { n as m, r as h, t as g } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-Bm-iyjmq.mjs";
5
5
  //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
6
6
  var _ = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), v = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), y = (e) => {
@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
3
3
  var e = {
4
4
  "@camstack/sdk": {
5
5
  name: "@camstack/sdk",
6
- version: "1.2.49",
6
+ version: "1.2.50",
7
7
  scope: ["default"],
8
8
  loaded: !1,
9
9
  from: "addon_pipeline_analytics_widgets",
@@ -18,7 +18,7 @@ var e = {
18
18
  },
19
19
  "@camstack/types": {
20
20
  name: "@camstack/types",
21
- version: "1.2.127",
21
+ version: "1.2.128",
22
22
  scope: ["default"],
23
23
  loaded: !1,
24
24
  from: "addon_pipeline_analytics_widgets",
@@ -33,7 +33,7 @@ var e = {
33
33
  },
34
34
  "@camstack/ui-library": {
35
35
  name: "@camstack/ui-library",
36
- version: "1.2.90",
36
+ version: "1.2.91",
37
37
  scope: ["default"],
38
38
  loaded: !1,
39
39
  from: "addon_pipeline_analytics_widgets",